CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CVE-2026-16264 Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...

CVE-2026-18365 Zportals < 6.4.2 - Subscriber+ User Email Disclosure

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators...

CVE-2025-15696 Real3D Flipbook Lite < 5.4 - Author+ Stored XSS

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...

CVE-2022-4997 JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-86785 Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

CVE-2026-19438 Mint Workbench I Path traversal Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Mint Workbench I. This issue affects Mint Workbench I: through 5876...

CVE-2026-96258 onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

CVE-2026-96257 Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copymsgelement of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and...

CVE-2026-95958 JusticeRage Manalyze PE Parser pe.cpp _parse_relocations integer underflow

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::parserelocations of the file manape/pe.cpp of the component PE Parser. Performing a manipulation of the argument BlockSize results in integer underflow. The attack requires a local approach. The patch ...

CVE-2026-95957 SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...

CVE-2026-91777 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-91776 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-95929 iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection

A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sq...

CVE-2026-95928 recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization

A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/minditerator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the...

CVE-2026-95927 SourceCodester Online Reviewer Management System exam-delete.php sql injection

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument testid leads to sql injection. The attack may be performed from remote. The...

CVE-2026-95926 SourceCodester Online Reviewer Management System btn_functions.php update sql injection

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer0/admins/assessments/pretest/btnfunctions.php?action=update. This manipulation of the argument testid causes sql injection. The attack is possib...

CVE-2026-95925 SourceCodester Online Reviewer Management System btn_functions.php update sql injection

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=update. The manipulation of the argument difficultyid results in sql injection. The attack can ...

CVE-2026-95924 SourceCodester Online Reviewer Management System btn_functions.php add sql injection

A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=add. The manipulation of the argument difficultyid leads to sql injection. Remote exploitation of the...

CVE-2026-95897 Dask Loader core.py from_npy_stack deserialization

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

CVE-2026-96273 Ghidra before 12.1.4 Denial of Service via Crafted Database

Ghidra before 12.1.4 fails to validate the TYPECOL byte in OptionsDB.createUnregisteredOption, causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and...

CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-95868 AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection

A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqliquery of the file admin/displaymenu.php of the component Search Form. This manipulation of the argument s1 causes sql injectio...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-95833 itsourcecode Leave Management System index.php sql injection

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-95830 theRealSain Pixtream post_upload.php unrestricted upload

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-95829 TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The...

CVE-2026-94367

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

CVE-2026-92930

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...

CVE-2026-92929

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...

CVE-2026-57576 plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...

CVE-2026-95828 Mstfakts College-Management-System Authentication server.php session_start session fixiation

A vulnerability was determined in Mstfakts College-Management-System. This affects the function sessionstart of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-95820 anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-18176 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information...

CVE-2026-18173 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18172 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-18169 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-18170 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...

CVE-2026-18163 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data...

CVE-2026-18162 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...